Supabase open email/password signup — disable external_email_enabled

email:true, disable_signup:false, mailer_autoconfirm:false on venus Supabase project fjnhfjwskixzsilxrkph — open signup via public/publishable key is a mail-relay/brand-exposure risk (same family as incident 1386350). Fix is external_email_enabled:false (NOT disable_signup:true — venus has real existing Google-auth users, disable_signup is server-wide and would block them too). BLOCKED: requires Supabase Management-API PATCH, no venus host holds a Supabase PAT. Riding mars's fleet-wide PAT + email-toggle ask to Elazar rather than filing a separate one. Also a candidate for the config-as-file + diff-on-push drift check the aro:coders room converged on. Site URL / /auth/callback redirect allow-listing already verified correct — not part of this fix.